Hi,
I'd a look at this again. The oops disappears (for me), if you add
an ax25_stop_heartbeat(ax25) to ax25_disconnect in ax25_subr.c:
diff -u linux-orig/net/ax25/ax25_subr.c linux/net/ax25/ax25_subr.c
--- linux-orig/net/ax25/ax25_subr.c Wed Jul 22 22:45:58 1998
+++ linux/net/ax25/ax25_subr.c Tue Jun 15 10:15:54 1999
@@ -309,6 +309,7 @@
ax25_stop_t2timer(ax25);
ax25_stop_t3timer(ax25);
ax25_stop_idletimer(ax25);
+ ax25_stop_heartbeat(ax25);
ax25->state = AX25_STATE_0;
73s Hans-Peter
